Threat Intelligence

3/20/2018
10:30 AM
Paul Kurtz
Paul Kurtz
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

The Case for Integrating Physical Security & Cybersecurity

Aggregating threat intel from external data sources is no longer enough. You must look inside and outside your traditional knowledge base for the best way to defend against attacks.

Early last year in "Grizzly Steppe and Carbanak: The Dangers of Miscalculation in Cyberspace," TruSTAR researchers outlined the overlap of tactics, techniques, and procedures (TTP) between Russian state organizations and criminal organizations like the Carbanak hacking group. We found that Carbanak and attacks attributed to Russian state security agencies were utilizing some the same infrastructure to launch attacks. CrowdStrike's new 2018 Threat Report expands the aperture beyond Russia to include to North Korea, China, and Iran. There's evidence hacktivists borrow these TTPs too.

The overlap of TTP raises serious questions for defenders of corporate and government networks, and poses a danger of miscalculation for government in responding to attacks. Overlapping TTP also drives home the need to change our security strategy at the organizational level to a unified security data model that can help organizations better defend themselves and collaborate with other companies, sharing organizations, and even government agencies.

Too often, security teams silo event data into multiple categories like fraud, phishing, malware, DDoS, insider threats, and physical breaches, just to name a few. These are often handled by separate teams requiring different skills sets, which is understandable. But it's also surprising that we separate the data around these events and fail to correlate it in a common repository to identify trends and patterns in TTP.

Take spear phishing, for example. We know spear phishing campaigns often insert malware strains that can lead to advanced persistent threats through command-and-control servers. DDoS obviously disrupts networks, but it is also used as a means to establish a persistent presence. Physical breaches lead to malware implants. Our failure to fuse this data leaves us vulnerable to adversaries, creating dangerous inefficiency for security operators. Without a comprehensive understanding of event data across an entire organization, we place ourselves at a permanent disadvantage.

Where Collaboration Is Already Happening
Several large companies in finance, cloud services, insurance, health, and retail are now integrating their event data associated with fraud, malware, DDoS, and phishing. (Physical breach data is a laggard.) For example, Rackspace Chief Security Officer (CSO) and TruSTAR adviser Brian Kelly recently broke down his decision to combine physical security and cybersecurity in The Wall Street Journal. Kelly argued that in the case of executive protection, the number of spear phishing and spoofing attacks against top executives clearly mark this area as both a physical and cyber problem.

Progressive security teams are also integrating relevant data associated with the protection of their own infrastructure as well as that of their customers. This data model does not rely on adoption of a particular data format or protocol such as STIX. Companies using this approach can leverage internal resources including security information and event management (SIEM) systems, case management, endpoint detection, and vulnerability data with relevant external data feeds including everything from threat intelligence to insights from information sharing analysis centers (ISACs) to government insights.

The key component to a unified security data model relies on a centralized common knowledge repository. A common knowledge repository of security-related events can align teams and make working together more effective. Security teams can then visualize relationships in real time and exchange notes to streamline responses and save time. This approach also creates a historical reference point, which can expedite a forensic investigation when a breach or disruption occurs.

This framework extends beyond individual organizations. Like-minded organizations can easily leverage insights from others using cloud-based technology. Machine learning can identify trending TTPs in real time, enabling others to proactively defend themselves by ingesting insights and modifying their SIEM and firewall profiles accordingly.

Adoption of a unified security data model is a step beyond a traditional threat intelligence platform. Aggregating data from external sources is no longer enough. You must look at your entire organizational knowledge to accurately to determine relevance, context, and priority.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX and learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 security track here. Save $200 off your conference pass with Promo Code DR200.

Paul Kurtz is the CEO and cofounder of TruSTAR Technology. Prior to TruSTAR, Paul was the CISO and chief strategy officer for CyberPoint International LLC where he built the US government and international business verticals. Prior to CyberPoint, Paul was the managing partner ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/22/2018 | 10:44:26 AM
Physical security and social engineering
It's crazy to me that this isn't basic stuff yet. Post-It notes on the screen, anyone?

Not to mention how often social engineering is successfully used as a vector for attack, including socially engineering oneself onto the premises. 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/21/2018 | 1:14:40 PM
True story
2 weeks ago my wife, daughter and her 3 year old daughter, came to visit my office which is very tightly controlled with badge cards and readers.  We ate lunch in the cafeteria and visited my colleagues.  All were delighted to meet little Cariana.   But at the end of their visit, little 3 year old Cariana takes all the cards and said "they have to be returned" and with them in hand, walked across the lobby to security and handed them in.  The woman in the office was enchanted!!!!   A 3 YEAR OLD understands the concept of perimeter security BETTER than most adults!
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
Securing Social Media: National Safety, Privacy Concerns
Kelly Sheridan, Staff Editor, Dark Reading,  4/19/2018
Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training
Sara Peters, Senior Editor at Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.